Memory usage - 'mapped file'??

I have 16GB of physical RAM, about 2.5GBs of which is used up after Windows 10 (20H2) loads.

I just moved a few files from one of the SSDs to an external drive and did one or two other 'management' tasks. Now, with all applications closed again, my used RAM registers as around 7GBs and I have been browsing forums trying to understand where the extra 4.5GBs is being 'held'. But I am not really getting that far. Can anyone help please?

In essence, is it possible to ascertain which processes I ran are responsible for the RAM usage? (Also read articles about Windows' 'Standby Memory' but not sure if that is relevant to what I am seeing or not).

I got as far as installing RamMap, but I am not sure how to proceed now in identifying which processes are involved. And if I do identify them, what do I do to regain the RAM without rebooting? Kill them (not usually the best option!)? Or will the RAM be released as needed, so I shouldn't even worry about this? (Even so, be good to know what's going on).

I attach a couple of screenshots. How do I investigate this further? The PC is mostly used for X-Plane 11, so I tend to reboot before running it (as it can use up up to 90% of my RAM - though usually a lot less than that).

Thanks

martinlest said:

I have 16GB of physical RAM, about 2.5GBs of which is used up after Windows 10 (20H2) loads.

With 16GB, you mostly don't need to think about it. But if you do:

martinlest said:

In essence, is it possible to ascertain which processes I ran are responsible for the RAM usage?

Well, you have obviously found Task Manager - why not look at (one of) the relevant tabs, like this:

Click on the memory column to make it sort in descending size, and you will see what is using it up. You can see more detail under the details tab.

.. thanks for the replies. Am kind of otherwise occupied at the moment, but will look at the links carefully and post back as soon as I can.

Well, you have obviously found Task Manager - why not look at (one of) the relevant tabs, like this

... because the tasks are no longer running by then.. it's what they leave behind after they have been closed that I am querying.

martinlest said:

because the tasks are no longer running by then.. it's what they leave behind after they have been closed that I am querying.

If the tasks are not running, they shouldn't be using any memory. If they are using memory, this should show up - or you wouldn't know there was a problem. Either way, TM (or Performance monitor, or any other memory utility) should be able to show you how much is being used, and by what process.

If the tasks are not running, they shouldn't be using any memory

I couldn't agree more, they shouldn't: but if you read my original questions, the point I am making is that after closing down programmes, some do not give back their RAM (so to speak).. a problem as old as Windows really.

My question concerned how to identify which processes (now stopped) contribute to the 'mapped file' and 'process private' columns shown in the screenshot. They do not belong to currently active processes... the sum of RAM being used shown in TM for instance is far smaller than the actual amount of RAM which is 'taken'.

I accept that I didn't address the question of mapped files - because I didn't really know about it. What was not clear from your original post was whether any memory shown as 'used' but not linked to an active proces was preventing other programs from running. I would expect stuff held in reserve (because it has recently been accessed) to quietly disappear when new data is required to be accessed. I don't know if that is failing to happen for you.

However, I have had the full (?) suite of Sysinternals programs on my PC for years, so thought I'd give Rammap a go. This is what my 'use counts' tab looked like:

As you can see, I have over 12GB of mapped file space, but only 600MB is active. AIUI, the standby stuff will make room for anything new as required. The bulk of yours was in standby, it is the 2.6GB of active lump you need to identify. To find out what is in that MF space, my file summary tab shows this:

In my case, most of the space is taken by a Reflect image, as MR was running (or had run recently). So you should be able to use this tab to see what is occupying your MF space. I wondered how I could learn more about the MF space, so had a look on the Sysinternals Rammap page. https://docs.microsoft.com/en-us/sysinternals/downloads/rammap

and there is a link to definitions of the Rammap labels! - disappointingly, this is to a printed book which MS is not giving away. However, under 'learn more' there is a link to an informative (if frustrating) video about Rammap, which I have watched some of. In particular, the speaker refers to 'zombie' processes (~23minutes in) which are in some way disconnected (dead) but still using RAM - but he doesn't really explain how to identify them - but does mention looking for PIDs in the 'processes' tab that are not real - I guess that means the same PIDs don't appear in TM. Those would be quite a chore to identify. But he does explain a bit about the MF space, which seems to be anything that has been read from disc (executable, data etc).

But I also googled for 'windows internals book' and amongst the many offers for a printed copy I found a link to a pdf of at least part of the 7th edition. I won't copy the link here, but if you find it, on p328 of 1120 (!) there is discussion about 'mapped files' (but it was not that helpful to me).

Note that over an hour later, after a refresh, my system was still 'hanging on' to those Reflect image files, just in case.

Hope that helps a bit - Martin